Valve’s Steam platform has become a prime hunting ground for cybercriminals in recent months, and now security researchers have uncovered yet another tactic being used to compromise user accounts in a new scheme currently being investigated by the FBI.

According to a new report from cybersecurity firm Kaspersky, attackers are hiding malware inside animated wallpapers distributed through Steam Workshop, many of which feature popular “waifu” imagery to lure unsuspecting players.

Steam wallpaper

Hackers Use Steam Workshop to Spread Malware

The scheme takes advantage of Wallpaper Engine, a legitimate tool that allows users to apply dynamic backgrounds to their desktops. Hackers upload seemingly harmless wallpaper packages to Steam Workshop, but embedded in them are hidden files that execute malicious code in the background.

Once installed, the malware can steal login credentials and other sensitive data, giving attackers full access to victims’ Steam accounts.

While Kaspersky notes that this type of attack has been most prevalent in China and Russia, confirmed cases have also surfaced in Singapore, Hong Kong, Germany, and Canada. The company warns that dozens of infected wallpaper packs, many featuring anime-style waifu images, are currently available on the Workshop, making the threat both widespread and difficult for average users to detect.

In response to the growing danger, security experts are urging PC gamers to exercise extreme caution when downloading any third-party content from Steam Workshop, particularly wallpaper files. Valve has yet to issue an official statement, but it is expected that the company will take action soon to protect its user base.

Steam hackers

Valve Fights Back Against Hackers

This is not the first time Steam has been targeted. Valve has moved swiftly to remove a wave of malicious free games that were being used to distribute malware, a campaign now under investigation by the FBI.

Authorities suspect that a single group may be behind many of these coordinated attacks, and they have called on the gaming community to assist in tracking down those responsible.

In a separate but related move, Valve has also pulled physical Steam gift cards from retail stores due to rising incidents of fraud involving the cards. Going forward, users will no longer be able to purchase or redeem physical cards, a decision aimed at curtailing criminal activity on the platform.

For more news on Steam-related topics, click here.